We are monitoring sub-interfaces on a Palo Alto firewall. The port speed traffic reported on Librenms for the device exceeds the overall speed available to the port channel. For example the port channel is configured for 20Gbps but we’re getting port utilization alerts because it is showing 24Gbps of traffic (down) on a sub-interface. Is the traffic being reported cumulative traffic over a period of time?
Are they “casual” spikes or is a continuous report?
If spikes, enable rrdtune + check poller performance.
If its continuous, run poller.php by hand and check what is reporting your Palo Alto firewall.
It seems to be casual spikes. If I do a real time graph with the polling interval set at 1s the reported spikes are more accurate. I tried rrdtune but I’m not sure what you mean by check poller performance.
Also check this doc out https://docs.librenms.org/Support/FAQ/#faq15
and performance doc https://docs.librenms.org/Support/Performance/
